I have a problem with a PCI DSS - requirement in Oracle 11.2. (PCI DSS = Payment Card Industry Data Security Standard)
Problem:
we connect via ' ssh -2 -X -l oracle hostname ' to the databaseserver and become os-user 'oracle'. we have also two offshore locations with dba's and each dba comes with his personalized user to the jumphost and then with the above ssh command to the database server.
the problem is that each dba becomes the oracle-os-account and can now connect with '/ as sysdba' to the database.in pci-dss this is not allowed !
now my question:how can I audit these '/ as sysdba'-connections and prove which user connected at which time with the '/ as sysdba' command ?
database is in audit mode. we log to syslog on linus redhat 5. I know one solution could be setting "SQLNET.AUTHENTICATION_SERVICES" parameter to "NONE" in sqlnet.ora file will make it not possible to connect to the database without a password as sysdba. (sqlplus / as sysdba). but we have to many applications and jobs and this is not really the solution in this case.
I think I can only solve this problem with personalized OS-user DBA-accounts in the dba-goup on os-site and os-user oracle should not be used for the future ?? I also need personalized dba-user-accounts in the database. using sys and system is not allowed. this users has to be locked and only for special administration work could it be unlocked.
I have a problem with my Oracle istance and so far I couldn't fix it, I have and Oracle 11g XE istance running on windows server 2003.A couple of days ago I received the error message "ORA-00257: archiver error".I found tips in this forum and wanted to apply but sqlplus doesn't recognize my SYS user/password. I type the correct password but no chance to log in.
If I try to connect using a client like Toad, I receive the message ORA-12170: TNS:Connect timeout occurred. I checked the firewall rules, but it's ok, moreover I was logging in in the past and any change has been performed on it. I learned it's possible to change SYS password.
If I connect as "/ as sysdba" on sqlplus I read "Connected to an idle istance".In order to connect as "/" I had to update sqlnet.ora and restart the service. The parameter SQLNET.AUTHENTICATION_SERVICES
was set as NONE ad I set as NTS. I should probably have to set it as ALL? I found out the orapwd utility to change SYS password throught password file for remote login as sysdba.
I tried to create that file, and when I ran the command it asked me the SYS password, I typed it and it created the file, so I guess the password I type is correct (I had the question to type it wrong). I didn't go to the next step as I wasn't sure to make the right thing and I don't want to make this issue bigger.
As long as I can't log in as sysdba I can't perform the actions mentioned in tips to fix the error 257, but I'm also wondering if the archive error can have a side effect and deny the action of update the SYS password.
For auditing, I need to insert the user, among other data, into different tables. The thing is, I have an application with DB account authentication, so a real database user is connected, when auditing, the user field inserted is "ANONYMOUS".
Apex 4.2 EPG Oracle Enterprise Linux 5.5 Database 11.2 EE
I got ORA-12528 while i was connecting sys as sysdba from remote machine to theinstance which is started in nomount mode. Although tnsping for that instance is working.
A function returns the metadata of named objects (Directories, Users, Tablespace....) in the form of DDL. When i execute the function in the schema having the privileges of CONNECT, RESOURCE, DBA, SELECT ANY TABLE, UNDER ANY VIEW AND EXECUTE ANY PROCEDURE, function returns the empty clob without any error. But he same function created and executed in the User having SYSDBA privilege, we get output.how to get output without SYSDBA privilege ?
CREATE OR REPLACE FUNCTION SCHEMA.DBLINK RETURN CLOB AS v_meta_handle NUMBER; v_meta_handle_trans NUMBER; V_DOC CLOB; V_LOB CLOB; [code]....
Connected to: Oracle Database 11g Enterprise Edition Release 11.2.0.1.0
I don't want to log in any one as sqlplus / as sysdba.If they can able to login as sqlplus / as sysdba then they can see others schema in the database.Say if i set
SQLNET.AUTHENTICATION_SERVICES=none
no one can log in as sysdba were as later some one changes to
SQLNET.AUTHENTICATION_SERVICES=NTS After they changes to NTS they can log in and access other user details right ? how to restrict
"C:UsersKarthikeyan>sqlplus / as sysdba SQL*Plus: Release 12.1.0.1.0 Production on Sat Sep 7 17:42:37 2013 Copyright (c) 1982, 2013, Oracle. All rights reserved. ERROR:ORA-12560: TNS:protocol adapter error Enter user-name:"
this is the first time i tried to open sql*plus and i didn't create any database connection before....so i don't have any username and password.......
so when i changed my idle_time value in profile and the when the user exceeds the idle_time value the user still i can see in-active state in v$session.
and when i was tried to execute any query on inactive session that time i got an ORA- error and then session was not visible from v$session.
in my environment inactive session was not getting used afterwards so is there any way to kill that sessions automatically once reached idle_timeout value.
lets say i have 50 max sessions, out of which 10 are inactive state and 40 in active state .what if i created one more sessions will that give me ORA- error stating max sessions reached or it will kill the one session which are in-active state.
insight into the overheads for mutally authenticated SSL for database connections? This is over a fast local network, to a RAC cluster, with DB firewall in front. There's always a large element of "it depends"
Information I'm interested in are things like latency for initial session setup and subsequent data transfer. Also the increase in network packet size, and the increase in CPU cost for the database server. I guess there is some implications for session memory usage as well.
I am in a bit confusion about the user when we are logging in to sqlplus /as sysdba. what the user is when we are into sqlplus with sqlplus /as sysdba.
We are interested to find the number of connections from specific client. Is tracing on sqlnet.ora in the client machine the answer? If yes, which trace has the information?
I used the following command : ------------------------------------------------- D:oracleproduct10.1.0Db_2jdkinjava -Djava.security.properties=D:oracleproduct10.1.0Db_2sqlplusadminiplusprovider -jar D:oracleproduct10.1.0Db_2oc4jj2eehomejazn.jar -user "iSQL*Plus DBA/admin" -password welcome -shell --------------------------------------------------------
Output as follows: -------------------------------------------- oracle.security.jazn.JAZNRuntimeException: Configuration file "configjazn.xml" does not exist. Check your JAAS configuration settings.at oracle.security.jazn.JAZNConfig.getJAZNProperties(Unknown Source) ... ... ... Realm [iSQL*Plus DBA] does not exist in system. -----------------------------------------------
+ Oracle 11g + Centos 5.5 + I create many users by shell script (user01, user02, user03 ..... user0n) + How can I connect all user to Oracle database in Centos (may be create connect.sh) - command line env ? ...... // user01 , user02 ... ---===> connect Oracles ? My idea: using fork to create multi sqlplus to connect but it cant o_0
If all users can connect to Orcl db, I can count real user connections.
I try to login as SYS@sid AS SYSDBA When I login via TOAD, I am able to. However, as in (1), all my attempts to login from command-line SQL *Plus fails. The error I get is ORA-1031 Insufficient Privileges Even if I am on the physical server and try to run the SQL *Plus, I get the same error -- Insufficient Privileges
Here are the environment details:
Server: Windows Server 2008 R2 Server: Oracle Database 11g Enterprise Edition Release 11.2.0.1.0
Client: Windows 7 Professional Client: SQL*Plus: Release 11.2.0.1.0 Production
I have a 2 RAC node cluster . The problem is that the second listener is not registering any connections . I have verified the services of listener using lsnrctl status (the default name is LISTENER), i also have verified the local and remote listener parameters they are fine but running the fol query shows count =0 against inst_id=2;
SQL > select count() from gv$session where username='XYZ' and inst_id=2;*
have some problem between my database and the listener Sometimes I have connection errors: The error occurred intermittently
Oracle 11.2.0.2.0 on RHEL 5 My listener: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXx LISTENER =
[code]...
The listener starts and stops normally XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXx >lsnrctl start LSNRCTL for Linux: Version 11.2.0.2.0 - Production on 16-JUL-2012 17:51:09 Copyright (c) 1991, 2010, Oracle. All rights reserved.
But there is an error when the database register into the listener (in listener.log): XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXx Started with pid=4029 Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=xxxxxx)(PORT=1521))) Listener completed notification to CRS on start
I have a database in which DB extended auditing is enabled but there are no audit specifications in privileges or statements or objects. So what will be audited in that case.
I have enabled auditing in my oracle9i DB, it is running fine, generating trails and I can capture those. Recently I checked in dba_audit_session table and found os_username, userhost, terminal showing null value whereas username is captured as my own (having dba prvis). Strange thing is that it doesn't occurs everyday.
One of the possibility of running batch files may occurs such issues, but I ran this batch everyday then why it is occurring some days only.
Attached File(s)
dba_audit_session.txt ( 2.71K ) Number of downloads: 4
on our 10.2.0.5 database, when we run full backup, my system performance comes to an halt. we run full backup and then do a validate backup to validate the structure of the database etc. Database performance takes a hit and all of the application connections goes in wait mode: On ASH or AWR - this is the top wait i see:
is it possible to login as SYSDBA in oracle forms from normal logon procedure?
logon(sys_acc, sys_pwd||'@'||:GLOBAL.db_conn);
The reason behind this is to make a form which will alter user's password. But all the users are in SYS account and it is necessary to login as SYSDBA in forms to execute alter statement.
I was asked if it was possible to restrict which users / or client IP's connect to my Oracle 11.2 database. I guess I could just shutdown the listener and have me and one other DBA connect to it via SSH / LOCALHOST but I was wondering if there was a more DBA specific way to restrict client connections to just two specific IP's over the Oracle listening port?
We have a custom portal application that uses a bunch of application servers. Our connection pool max size is 1100. For the past two days, we had two incidents when the cpus reached the max limit and the db was not allowing connections to come thro' for 10 minute periods. The alert log does not have any entry and the listener log does not have any entry for that 10 minute period.
I'm working on a Java-based web application and we have unit tests that we use to test all our all code that interacts with the database or code that interacts with our DB code. The Spring framework allows us to perform some DML within a transaction before each test and then rollback the changes. For the most part, this works, however when I run the full suite of unit tests, it will randomly commit data to the database causing the rest of the tests to fail.
will Oracle's auditing let me see where this odd-ball commit is occurring? Is there another way for me to see when data is being committed?
This does not appear to be happening on any of the systems we've deployed, however this is a bit unsettling and would like to know why this is occurring so that we can prevent it from happening in production.
I am trying to maintain data audit in the database using triggers where i want to write the row level trigger in an generic way using the following concept .Using USER_TAB_COLUMNS table inside the trigger i want to bind all column values of the row into a single string in the following format
COLUMN_NAME = Value(:new/:old.COLUMN_NAME)=> this value would be bound dynamically is it possible to create a string for each row instance in the trigger at run time using the above mentioned format and user_tab_column table
